Blood from a finger prick can be analyzed for viruses like HIV, but a new privacy rule may restrict research on such data in South Africa.

Ben Gilbert/Wellcome Trust

A new law was supposed to protect South Africans' privacy. It may block important research instead

To probe causes of cardiovascular disease, Michèle Ramsay of the University of the Witwatersrand in Johannesburg takes volunteers’ personal history, blood, and urine and looks for genes or stressors that might help predict hypertension or stroke. She also asks volunteers for permission to share their data with other scientists and to make them available for future studies, in what’s called broad consent—a standard request from some big databases in Europe and the United States. A decade from now, her data and samples could help answer a host of new questions.

But a new privacy law, scheduled to go into effect in 2020 and discussed by lawyers, ethicists, and researchers at a meeting here on 4–5 February, could upend such protocols in South Africa, a country whose varied population makes it a magnet for research on public health and human diversity. At a time when giant sample and data repositories called biobanks are transforming health research by allowing multiple researchers to ask different questions of the same data, South Africa’s rule could limit such secondary use of data and hamstring international collaborations. Where South Africa leads, other African countries might follow, adds Charles Rotimi, director of the National Institutes of Health’s (NIH’s) Center for Research on Genomics and Global Health in Bethesda, Maryland. “It may set a precedent.”

South Africa passed the Protection of Personal Information Act (POPIA) in 2013, but delayed enforcement to allow time to prepare and set up the required regulatory bodies. The law aims to protect South Africans from abuse of their personal data, and was modeled on an early draft of a privacy law in the European Union, the General Data Protection Regulation (GDPR). But the GDPR was later modified to make exceptions for research—and the POPIA hasn’t been.

The POPIA’s restrictive effects were only pointed out last year, when the Academy of Science of South Africa in Pretoria published a consensus study on the ethical implications of genomics. South Africa’s current, 2015 research guidelines allow broad consent. But the new law states that personal information—including genetic data—must be collected for a “specific, explicitly defined and lawful” purpose, and that data subjects need to be “aware of the purpose.”

At the meeting here, experts said the law could be interpreted to prohibit researchers from reanalyzing biobank data to answer new questions. “If you don’t have broad consent, there’s no point having a biobank,” says Natalie Harriman, research integrity officer at Stellenbosch University, which houses several biobanks. Michael Pepper, a geneticist at the University of Pretoria, says it’s also unclear whether the rules would apply retroactively to data collected before the law came into force. “You’d have to go back and reconsent people, and if you can’t then you’d have to get rid of that sample,” which would be costly.

The law doesn’t apply to data from which a person’s identity can’t be recovered, but this excludes genomic data by definition, because a person’s DNA sequence is unique. Social science researchers might also be barred from reusing photographs and personal narratives from ethnographic research, Harriman says. And sharing of sensitive health data such as HIV status might also fall foul of the law, because the data could technically be used to identify participants who have rare attributes.

Jantina de Vries, a bioethicist at the University of Cape Town (UCT), says the law addresses real concerns. “We have to [balance] real risks for individuals and the potential collective benefit of research,” she says. She is a member of the ethics working group of the Human Heredity and Health in Africa project, an initiative funded by NIH and the Wellcome Trust in London to study African genomes. The law could affect her project, which plans to allow scientists to reanalyze DNA and samples, subject to rigorous ethics scrutiny. She and others also note that the law could clash with a trend for funders such as NIH and Wellcome, as well as journals including Science, to require that data be published and freely shared. 

Pepper, Harriman, and many others are pinning their hopes to a provision the POPIA makes for “codes of conduct” to explain how the law will be applied in special areas such as research. The participants of the meeting here are working on such a code. Institutions might also be able to apply for individual exemptions, or the law could be modified to make it more research-friendly. But changing the law might take years, says Melodie Labuschaigne, a law professor at the University of South Africa in Pretoria.

Broad consent helps South Africa’s rich genetic heritage benefit humankind as a whole, Pepper says. “Preventing people from doing that work is a bit counterproductive,” he says. But Nicki Tiffin, a bioinformatician at UCT, says giving participants more control over their samples and data may not be a bad thing in a country where many hail from poor and vulnerable communities that may have been exploited in the past. By encouraging their participation, she says, the law may help research in the long run.

*Correction, February 22, 11 a.m.: An earlier version of this story incorrectly stated Jantina de Vries's position with the Human Heredity and Health in Africa project.